How Can I Block Computers Access To Other LAN Computers; Only Allow Access To WAN?

I'm sure that the answer to this question is simple but I can't find the solution after some looking.

We in the past set up a FortiGate firewall with FortiAP's. On the SSID configuration used for guest wireless we selected to Block Intra-SSID Traffic.

This time we have the same objective, but the equipment and topology are different. We're using a FortiGate 100D, the ports are in Interface mode. Port2 is connected to a switch. The switch connects to wired computers and to old un-managed Netgear WAP's. The FortiGate is handling DHCP. All of the computers on this Port2 are on the same subnet. There is one policy that allows communication from Port2 to WAN1. Because each of the wireless and wired users are guests we don't want any intra-subnet traffic. We only want the computers and wireless devices to access the WAN only. I have not been able to confirm if intra-subnet traffic is blocked as the network is remote but I don't know why it would be. How do we block intra-subnet traffic? What am I missing?

Thanks!